A flaw was found in libssh server. When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique. The most important consequence is that servers using EC (ECDSA) or DSA certificates may under certain conditions leak their private key.

This issue only affects the server component of libssh library. libssh2 is not affected, since it is a client-side C library implementing the SSH2 protocol. (no server component).
Statement:
Not Vulnerable. This issue does not affect the version of libssh2 package as shipped with Red Hat Enterprise Linux 5 and 6.